Senior Manager, Security Operations

Role overview This is a founding leadership opportunity to build and run a Security Operations Center (SOC) for a large, multi-product technology organization serving nearly 100,000 customers across logistics, construction, energy, manufacturing, retail, and the public sector. Reporting to the CISO, the role owns the full detection-and-response lifecycle across both the production cloud estate (services, APIs, data platforms, and connected-device fleets) and the corporate IT environment (endpoints, identity, SaaS, email, network). Success looks like a small, senior, automation-driven team rather than a traditional tiered analyst model. Responsibilities Stand up and scale the SOC, including operating model, runbooks, escalation paths, hiring plans, and the chosen 24/7 coverage model (in-house follow-the-sun, MDR-augmented, or hybrid) Define and own the detection strategy end-to-end, treating detection content as code and mapping coverage explicitly to MITRE ATT&CK and an internal threat model Lead 24/7 incident response across product and enterprise environments, serving as incident commander for significant events and communicating with executives under pressure Own the security telemetry and analytics platform, including collection, normalization, enrichment, retention, and cost discipline, while measuring MTTD, MTTR, coverage, precision, and automation rate Build a hypothesis-driven threat hunting program and a tailored threat intelligence function that produces detections, hunts, and hardening priorities Partner with Platform Engineering to extend detection into production and cloud workloads, with priority coverage for identity-to-cloud pivot paths and unmonitored endpoints or workloads Requirements Senior leadership experience building or substantially transforming a SOC, with hands-on detection engineering capability Deep familiarity with modern detection-and-response tooling: SIEM or security data platforms, EDR, SOAR or equivalent automation, and cloud-native telemetry Strong background in cloud and container security monitoring, with AWS and Kubernetes experience preferred Solid understanding of identity-centric attack paths across SSO, OAuth, session compromise, MFA bypass, and privilege escalation in SaaS and cloud Demonstrated incident command experience on significant incidents, with sound escalation judgment and credible executive communication Concrete, measurable use of AI and automation inside security operations, with examples of what was built, what it replaced, and what changed Benefits and work setup Base compensation range of $140,000–$200,000 USD, with total compensation potentially including equity for certain roles Benefits include medical, pharmacy, dental, and vision coverage, paid and sick time off, short- and long-term disability, life insurance, and 401(k) contributions, subject to eligibility Globally distributed team with flexible time-zone coverage; some interviews or onboarding may occur in person at a global office Must be authorized to access U.S.-export-controlled technology #J-18808-Ljbffr gomotive